fix(miner): count the prompt-cache tiers as input tokens in the engine's own parsers

[JSONbored]

Summary

Rewritten after a collision. #10251 landed the ORB half of this fix while this branch was in flight, with a better measurement (2,048 input tokens across 1,000 calls over 48h — an average of exactly 2.0 — against $225.06 of real spend). This PR is now scoped to what #10251 did not touch: the engine's two deliberately-parallel copies of the same parser, which still read only input_tokens.

Anthropic — and therefore Claude Code and the Agent SDK — splits one prompt across three counters. input_tokens carries only the portion neither read from nor written to the prompt cache; with caching active, which it is for every attempt the CLI runs, essentially the whole prompt lands in cache_read_input_tokens and cache_creation_input_tokens.

So the miner still records a near-constant handful of input tokens per cached attempt, exactly as the ORB did before #10251.

Matching #10251 exactly, on purpose

The tiers are summed, mirroring the ORB's totalInputTokens arithmetic rather than inventing a second convention. These two files are parallel copies by design (the no-src-import boundary), so a divergence in how they compute the same figure would be worse than the bug: the same envelope would report different numbers depending on which surface saw it.

Each tier keeps its own alias group because the three are additive components of one prompt, not names for one value — folding them into INPUT_TOKEN_KEYS would take the maximum of the three and under-report again, just less severely.

Absence stays absence: an envelope with no input counter at all yields undefined rather than a fabricated 0, and a tier that is present but zero contributes a real zero. Providers emitting no cache keys — codex and the OpenAI-compatible bindings — are byte-identical to before, which is what makes changing the shared extraction point safe.

Closes #10246

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Also run and green: npm run build:miner, the @loopover/engine workspace suite (961 tests, rebuilt first so the dist/-importing tests exercised the new code), and npm run dead-exports:check.

If any required check was skipped, explain why:

• Coverage measured scoped to both changed files: 100% of the changed lines AND branches, verified line-by-line against lcov. The cases are added to both packages/loopover-engine/test/** and the root suite so each Codecov upload credits them independently.
• The unchecked commands cover untouched surfaces and are left to CI.

Tests added

A realistic cached envelope (input_tokens: 2, cache_read_input_tokens: 48210, cache_creation_input_tokens: 1536 → 49748), asserted through both drivers; a genuinely-zero tier still contributing zero rather than being read as absent; no input counter at all yielding undefined; and a no-cache-keys provider (codex / OpenAI-compatible) coming out byte-identical.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Token counts are metadata; no prompt or transcript text is added by this change.

UI Evidence

Not applicable — no visible UI, frontend, docs, or extension change.

Notes

What was dropped from the original version of this PR, and why. It had also changed src/selfhost/ai.ts and emitted $ai_cache_read_input_tokens / $ai_cache_creation_input_tokens to PostHog with $ai_cache_reporting_exclusive: true, keeping $ai_input_tokens as the uncached remainder. #10251 chose the opposite and better-measured convention — sum the tiers into $ai_input_tokens, making the count inclusive. Rebasing the old version on top would have set exclusive: true against an inclusive count, which makes PostHog add the cache on top of a figure that already contains it. That is precisely the over-billing in PostHog/posthog-js#3615, where costs came out 3.4× high for exactly that mismatch. So the ORB changes were dropped rather than merged.

One genuine gap remains and is filed separately: PostHog now receives a correct total input figure but cannot tell how much of it was cache reads, which bill at a fraction of fresh input, so its derived $ai_input_cost_usd over-states the input component. $ai_total_cost_usd is unaffected — it comes straight from the CLI. Fixing that means emitting the tiers alongside the inclusive total with $ai_cache_reporting_exclusive: false.

[loopover-orb]

Warning

⏸️ LoopOver review result - manual review recommended

_{Review updated: 2026-07-31 23:44:39 UTC}

6 files · 1 AI reviewer · no blockers · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This PR closes issue #10246 by reading Anthropic-style `cache_read_input_tokens`/`cache_creation_input_tokens` fields across all four parsers (selfhost ai.ts, cli-subprocess-driver.ts, agent-sdk-driver.ts) and threading them through to PostHog on both the ORB and miner sides, plus setting `$ai_cache_reporting_exclusive` so PostHog doesn't misprice cache reads as fresh input via its provider-name auto-detection. The design choice to report cache tokens separately rather than folding them into `inputTokens` is well-justified (different pricing tiers) and consistently applied at every call site, with the never-fabricate-absent-fields convention preserved throughout. Test coverage is thorough, covering both key spellings, cumulative JSONL streams, cache-only envelopes, and the single-vs-both-cache-field exclusive-flag edge case.

Nits — 4 non-blocking

• src/selfhost/ai.ts and src/selfhost/posthog.ts are both very large files (1861 and 653 lines) that this PR adds further surface area to; consider whether the parser/cache-key logic duplicated across ai.ts, cli-subprocess-driver.ts, and agent-sdk-driver.ts (three near-identical CACHE_READ_TOKEN_KEYS/CACHE_CREATION_TOKEN_KEYS definitions) could eventually be centralized, per the repo's own maintainability audit: 103 duplicated blocks, 267 functions with 6+ params, and a 16.9k-line file #10170 duplicated-block precedent it cites elsewhere.
• In src/services/ai-review.ts's coerceByokUsage, the comment notes cache fields are deliberately NOT read on the BYOK path because cache_control is never sent — worth double-checking that assumption still holds given this PR's broader cache-accounting push, so the BYOK and self-host paths don't silently diverge in what they report.
• Consider a shared constants module for the four *_TOKEN_KEYS arrays now duplicated in src/selfhost/ai.ts and packages/loopover-engine/src/miner/cli-subprocess-driver.ts.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Decision drivers

• ✅ Code review — No blockers (1 reviewer)
• ✅ Gate result — Passing (No configured blocker found.)

Context & advisory signals — never blocks the verdict

Signal	Result	Evidence
Linked issue	✅ Linked	#10246
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 9 registered-repo PR(s), 8 merged, 279 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 9 PR(s), 279 issue(s).
Improvement	✅ Minor	risk: clean · value: minor

Linked issue satisfaction

Addressed
The diff parses cache_read_input_tokens/cache_creation_input_tokens in both extractCliUsage-style parsers (ORB and miner), threads them through CliUsage/AiUsage/CodingAgentDriverResult, emits them as distinct PostHog properties, sets $ai_cache_reporting_exclusive when present, documents the deliberate choice to keep $ai_input_tokens as the uncached remainder next to the key definitions, and adds r

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local LoopOver cache.
• Public profile languages: Python, TypeScript, Ruby, Go, MDX, Shell, Solidity, JavaScript
• Official Gittensor activity: 9 PR(s), 279 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Start here: Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Then work through the remaining 1 step in the Signals table above.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

🧪 Chat with LoopOver

Ask LoopOver a question about this PR directly in a comment — grounded only in the same cached, public-safe facts shown above, never a new claim.

• @loopover ask <question> answers contribution-quality Q&A with source citations and freshness.
• @loopover chat <question> answers in natural prose from cached decision-pack facts via local inference (maintainer/collaborator; read-only).
• A plain-language @loopover mention with a real question is routed to the closest matching read-only command automatically — no exact syntax required.

Full command reference: https://loopover.ai/docs/loopover-commands

🧪 Experimental — new and may change.

Decision record

• action: hold · clause: success
• config: 8d898581a1475bf5b8b4cae35991005b8a72a650bc16ff60f8f2e4bc6aac6e9e · pack: oss-anti-slop · ci: failed
• record: c400f4ff6fc4c1eb0598f2a99336551b434b160fb4a1923fca02f28d6d8fa7cf (schema v6, head 3e60324)

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by LoopOver, a quiet PR intelligence layer for OSS maintainers.

• Re-run LoopOver review

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	loopover-ui	3e60324	Jul 31 2026, 10:54 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.30%. Comparing base (12f3c6a) to head (82b01ad).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #10252      +/-   ##
==========================================
+ Coverage   92.28%   92.30%   +0.01%     
==========================================
  Files         939      939              
  Lines      114775   114810      +35     
  Branches    27715    27729      +14     
==========================================
+ Hits       105920   105970      +50     
+ Misses       7553     7534      -19     
- Partials     1302     1306       +4     

Flag	Coverage Δ
backend	95.69% <100.00%> (-0.01%)	⬇️
engine	74.26% <100.00%> (+0.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ages/loopover-engine/src/miner/agent-sdk-driver.ts	95.97% <100.00%> (+0.15%)	⬆️
...loopover-engine/src/miner/cli-subprocess-driver.ts	80.87% <100.00%> (+5.75%)	⬆️

... and 1 file with indirect coverage changes

[loopover-orb]

LoopOver approves — the gate is satisfied and CI is green.